Medium severity · published Oct 21, 2026
CVE-2026-114105
Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
6.2
CVSS
0.1%
EPSS
No
On KEV
Description
Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
adm-zip · cthackers
before 0.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114105
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114105
github.com
https://github.com/cthackers/adm-zip/security/advisories/GHSA-qjf8-53jv-w9w6
www.vulncheck.com
https://www.vulncheck.com/advisories/adm-zip-before-0.6.1-privilege-escalation-via-keeporiginalpermission-setuid-bits
More from adm-zip
7.5
CVE-2026-114102
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
7.5
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
7.5
CVE-2026-92000
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
7.1
CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
6.5
CVE-2026-76845
adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction